Filename: UserController.java
Line: 898
CWE: 209 (Generation of Error Message Containing Sensitive Information ('Information Leakage'))
The application calls the javax.mail.Transport.send() function, which may expose information about the application logic or other details such as the names and versions of the application container and associated components. This information can be useful in executing other attacks and can also enable the attacker to target known vulnerabilities in application components. The first argument to send() contains data from an error message (possibly containing untrusted data) from the variable message. The data from an error message (possibly containing untrusted data) originated from earlier calls to java.lang.NullPointerException.getMessage, java.lang.Throwable.getMessage, and java.lang.Throwable.printStackTrace. Ensure that error codes or other messages returned to end users are not overly verbose. Sanitize all messages of any sensitive information that is not absolutely necessary. References: CWE
Filename: UserController.java
Line: 898
CWE: 209 (Generation of Error Message Containing Sensitive Information ('Information Leakage'))
The application calls the javax.mail.Transport.send() function, which may expose information about the application logic or other details such as the names and versions of the application container and associated components. This information can be useful in executing other attacks and can also enable the attacker to target known vulnerabilities in application components. The first argument to send() contains data from an error message (possibly containing untrusted data) from the variable message. The data from an error message (possibly containing untrusted data) originated from earlier calls to java.lang.NullPointerException.getMessage, java.lang.Throwable.getMessage, and java.lang.Throwable.printStackTrace. Ensure that error codes or other messages returned to end users are not overly verbose. Sanitize all messages of any sensitive information that is not absolutely necessary. References: CWE